feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill

2026-03-30 00:17:04 +02:00
parent 2b7d3257da
commit e2e2c4fc07
11 changed files with 434 additions and 13 deletions
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -242,6 +242,7 @@ pub struct UseragentClient {
    pub id: i32,
    pub nonce: i32,
    pub public_key: Vec<u8>,
+    pub pubkey_integrity_tag: Option<Vec<u8>>,
    pub created_at: SqliteTimestamp,
    pub updated_at: SqliteTimestamp,
    pub key_type: KeyType,
--- a/server/crates/arbiter-server/src/db/schema.rs
+++ b/server/crates/arbiter-server/src/db/schema.rs
@@ -178,6 +178,7 @@ diesel::table! {
        id -> Integer,
        nonce -> Integer,
        public_key -> Binary,
+        pubkey_integrity_tag -> Nullable<Binary>,
        key_type -> Integer,
        created_at -> Integer,
        updated_at -> Integer,